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1 DETAILED ACTION 

2 

3 This action is in response to the communication filed on 8/17/2005. 

4 

5 All objections and rejections not set forth below have been withdrawn. 

6 

7 

8 Specification 
9 

10 The specification is objected to as failing to provide proper antecedent basis for 

1 1 the claimed subject matter. See 37 CFR 1 .75(d)(1) and MPEP § 608.01 (o). Correction 

12 of the following is required: Applicants have amended claims 1,2, 12, 13, 20, 22, 27, 

13 28, and 30 - 33 to include limitations for the "automatically" generating of an access 

14 control time or the "automatically" generating of a virus alert time. Furthermore, these 

1 5 claims have also been amended to include the limitations of a "real time" determination 

16 of computer content executability. These added limitations are not described nor find 

17 support in the specification as presented. 
18 

19 

20 Claim Rejections •35USC§112 

21 

22 The following is a quotation of the first paragraph of 35 U.S.C. 112: 
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1 The specification shall contain a written description of the invention, and of the manner and process of 

2 making and using it. in such full, clear, concise, and exact terms as to enable any person skilled in the 

3 art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 

4 set forth the best mode contemplated by the inventor of carrying out his invention. 
5 

6 Claims 1-17 and 20 - 33 are rejected under 35 U.S.C. 1 12, first paragraph, as 



7 failing to comply with the written description requirement. The claim(s) contains subject 

8 matter which was not described in the specification in such a way as to reasonably 

9 convey to one skilled in the relevant art that the inventor(s), at the time the application 

10 was filed, had possession of the claimed invention. See objection to specification 

1 1 above. 
12 

13 



1 4 Claim Rejections - 35 USC § 102 

15 

16 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 

17 form the basis for the rejections under this section made in this Office action: 

18 A person shall be entitled to a patent unless - 

1 9 (e) the invention was described in (1 ) an application for patent, published under section 122(b), by 

20 another filed in the United States before the invention by the applicant for patent or (2) a patent 

21 granted on an application for patent by another filed in the United States before the invention by the 

22 applicant for patent, except that an international application filed under the treaty defined in section 

23 351(a) shall have the effects for purposes of this subsection of an application filed in the United States 

24 only if the international application designated the United States and was published under Article 21 (2) 

25 of such treaty in the English language. 
26 

27 Claims 1-10 and 12 - 33 is rejected under 35 U.S.C. 102(e) as being 

28 anticipated by Bates et al., U.S. Patent 6,721,721 B1. 

29 

30 Regarding claim 1 , Bates et aL discloses: 
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1 entering a first computer virus status mode in response to a first computer virus 

2 outbreal< report (Bates et al., col. 1 , lines 1 3-52). Bates et al. reports tlie outbreak of 

3 new and more sophisticated viruses. The invention as disclosed by Bates et al. is for 

4 the purpose of protecting against these outbreaks. 

5 automatically generating a first computer virus alert time corresponding to entry 

6 into the first computer virus status mode (Bates et al., fig. 7, elem. 214; col. 7, lines 20- 

7 35); Bates et al. discloses a method for accessing computer content on a local machine 

8 or on a network. Content is filtered based upon a generated virus alert time entered by 

9 a user in a virus status mode defined by the user. Furthermore, Bates et al. discloses 

10 an administrator providing time control parameters the system in a human-readable 

1 1 form (Arabic numerals) via an input means, such as a keyboard. However, these 

12 human-readable control parameters are "automatically" converted into meaningful 

1 3 computer-readable form for the system to act upon. 

14 comparing a time stamp of a computer content with the first computer virus alert 

15 time (Bates et al., col. 12, lines 59-65); 

1 6 and determining in real time the executability of the computer content in 

1 7 response to the result of the comparing step (Bates et al., col. 9, line 56 - col. 10, line 

18 8). Bates et al. discloses that in response to a comparison, a determination of computer 

19 content executability is performed. This determination to executed computer content is 

20 made in real time. 
21 

22 
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1 

2 Regarding claim 2, Bates et al. discloses: 

3 automatically generating a first access control time based on the first virus 

4 outbreak report (Bates et al., fig. 7, elem. 214). The system of Bates et al. takes human 

5 input and "automatically" generates computer readable parameters. 

6 and converting the first access control time into the first virus alert time (Bates et 



7 al., fig. 7, elem. 214; col. 12, lines 59-62). A "prior point in time" ("virus alert time") is 

8 derived from the period of time specified by element 214 ("access control time") and is 

9 compared to the timestamp of the file. 
10 

1 1 Regarding claim 3, Bates et al. discloses: 

12 wherein the first access control time is a relative time stamp (Bates et al., fig. 7, 

13 elem. 214; col. 12, lines 59-62). A "prior point in time" ("virus alert time") is derived from 

14 the period of time specified by element 214 ("access control time") and is relative in 

15 time. 
16 



17 Regarding claim 4, Bates et al. discloses: 

1 8 wherein the first access control time is a pre-determined time period for access 

19 control under the first computer virus status mode (Bates et al., fig. 7, elem. 214). The 

20 access control time is pre-determined by the user. 
21 

22 Regarding claim 5, Bates et al., discloses: 



Application/Control Number: 10/046,496 Page 6 

Art Unit: 2137 

1 determining the presence of a value representing the computer content in a 

2 memory table of executable computer content (Bates et al., col. 7, lines 12-34). 
3 

4 Regarding claim 6, Bates et al., discloses: 

5 wherein the computer content is not executed when the value representing the 

6 computer content is not present in the memory table of executable computer content 

7 (Bates et al., col. 1 1 , lines 1 1-24; col. 3, lines 24-27). As disclosed by Bates et al., 

8 content not present in the memory table of executable computer content is flagged as 

9 untrustworthy. The invention as disclosed by Bates et al. is configurable to eliminate 

1 0 untrustworthy computer content from the list of accessible content, thus not providing 

1 1 access to the content for execution. 
12 

13 Regarding claim 7, Bates et al. discloses: 

14 wherein the value is a hash value of the computer content (Bates et al., col. 12, 

15 lines 55-58). 
16 

17 Regarding claim 8, Bates et al. discloses: 

1 8 wherein the computer content is executed only when the computer content is 

1 9 time stamped prior to the first computer virus alert time (Bates et al. , col. 1 3, lines 42- 

20 59; col. 3, lines 24-27). Computer content that is time stamped prior to the first 

21 computer virus alert time is branded as trustworthy. Thus, the content would not be 

22 subjected to denial of access for execution. 
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1 

2 Regarding claim 9, Bates et aL discloses: 

3 entering types of computer codes that should be blocked from execution in 

4 response to the first computer virus outbreak report (Bates et al., col. 9, line 62 - col. 

5 10, line 28); 

6 and blocking execution of a computer code that belongs to the entered types of 



7 computer codes (Bates et al., col. 3, lines 24-27). The invention as disclosed by Bates 

8 et al. is configurable to eliminate untrustworthy computer content from the list of 

9 accessible content, thus not providing access to the content for execution. 
10 

1 1 Regarding claim 10, Bates et al. discloses: 

12 generating a second virus alert time in response to a second computer virus 

1 3 outbreak report; comparing the time stamp of the computer content with the second 

1 4 computer virus alert time; determining the executability of the computer content in 

1 5 response to the result of comparing the time stamp of the computer content with the 

1 6 second computer virus alert time (Bates et al., col. 3, lines 5-15). The above 

17 limitations of claim 10 are essentially similar to claim 1 with the exception that they are 

1 8 directed to a second instance of the method of claim 1 . Bates et al. discloses that the 

19 method of claim 1 produces a set of results. Thus, Bates et al. discloses a secondary 

20 instance of the method of claim 1 , as a the word "set" dictates more than a singular 

21 occurrence of the method of claim 1 . 
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1 performing antivirus processing upon ttie computer content (Bates et al.. col. 9, 

2 lines 62-66). Bates et al. discloses the processing of computer content for the likelihood 

3 of existing viruses. 
4 

5 Regarding claim 12, Bates et al. discloses: 

6 an access control console, for entering a first computer virus status mode and for 

7 recovering a preselected virus access control time corresponding to said virus status 

8 mode (Bates et al., fig. 1 , elem. 33; fig. 7); 

9 an anti-virus module, coupled to the access control console, configured to 



1 0 automatically generate a virus alert time based on the virus access control time and to 

1 1 compare a time stamp of a target computer content with the virus alert time prior to 

12 execution of the target computer content (Bates et al., fig. 1, elem. 30; see rejections of 

13 claims 1 and 2). 
14 



15 Regarding claim 13, Bates et al. discloses: 

16 a memory module for storing time stamps of the plurality of computer contents 

17 (Bates et al., fig. 1, elem. 46); 

1 8 and an access control module, coupled to the access control console and to the 

1 9 memory module, for automatically generating the virus alert time and for comparing the 

20 time stamp of each target computer content with the virus alert: time (Bates et al., fig. 1 , 

21 elem. 42; see rejections of claims 1 and 2). 
22 
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1 Regarding claim 14, Bates et al. discloses: 

2 a computer virus processing module, coupled to the access control module, for 

3 further processing a target computer content in order to determine the executability of 

4 the target computer content (Bates et al., fig. 1 , elem. 44). 
5 

6 Regarding claim 15, Bates et al. discloses: 

7 wherein the memory module stores a value representing each of the computer 

8 contents (Bates et a!., col. 12, lines 52-65). 
9 

10 

1 1 Regarding claim 16, Bates et al. discloses: 

1 2 wherein the access control module is configured to determine the presence of 

1 3 the value in the memory module as representing a target computer content (Bates et al. , 

14 fig. 3). 
15 

16 Regarding claim 17, Bates et al. discloses: 

17 wherein the value is a hash value (Bates et a!., col. 12, lines 52-65). 
18 

19 Regarding claim 20, Bates et al. discloses: 

20 creating a list of time-stamped executable computer contents (Bates et al. , fig . 3, 

21 elem. 92). 
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1 entering a virus alert mode in response to a virus outbreal< report (Bates et al., 

2 fig. 2; col. 1, lines 13-52). 

3 responsive to the virus alert mode, entering an access control message for 

4 specifying an access control rule for blocl<ing the execution of suspicious or susceptible 

5 computer contents that are time-stamped not before an automatically generated virus 

6 alert time, the access control message including a first control parameter for generating 

7 the virus alert time (Bates et a!., fig. 2; fig. 7; see rejections of claims 1 and 2). 



8 receiving a request to execute a target computer content; and determining the 

9 executability of the target computer content based on the access control rule in the 
10 access control message (Bates et al., fig. 2). 

11 

12 Regarding claim 21. Bates et al. discloses: 

1 3 applying anti-virus operation upon each executable computer content, storing a 



14 hash value of each executable computer content in the list; and inserting a time stamp 

1 5 corresponding to the moment of storing the hash value of the executable computer 

16 content (Bates et al., fig. 3). 
17 

18 Regarding claim 22, Bates et al. discloses: 

1 9 receiving the access control message; automatically converting the first control 

20 parameter into the virus alert time; comparing the time stamp of the target computer 

21 content in the list with the virus alert time; and determining in real time the executability 
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1 of the target computer content based on the result of the comparing step (Bates et al. , 

2 fig. 2, fig. 3, fig. 7; see rejections of claims 1 and 2). 
3 



4 Regarding claim 23, Bates et al. discloses: 

5 applying an anti-virus operation upon the target computer content (Bates et al., 

6 fig. 3). 
7 

8 Regarding claim 24, Bates et al. discloses: 

9 a second control parameter for specifying types of computer contents that should 

10 be subject to the access control rule (Bates et al., col. 9, line 62 - col. 10, line 28); 

11 a third control parameter for specifying an expiration time for the access control 

12 rule (Bates et al., fig. 7, elem. 217); 

1 3 and a fourth control parameter for identifying the access control message (Bates 

14 etal.,fig. 2). 
15 

16 Regarding claim 25, Bates et al. discloses: 

1 7 detenvining validity of the access control message based on the third control 

1 8 parameter (Bates et al., fig. 3); 
19 

20 Regarding claim 26, Bates et al. discloses: 

2 1 determining executability of the target computer content based on the second 

22 control parameter {Bates et al., col. 9, line 62 - col. 10, line 28); 
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1 

2 Regarding claims 27 and 28, they are rejected for the same reasons as claims 20 

3 and 22, and further because Bates et al. discloses the usage of their system in a 

4 network of communicating computers (Bates et aL, fig. 1). Communications to a user 

5 can be blocked when computer content is deemed to be untrustworthy (Bates et al., col. 

6 3, lines 24-27, col. 14, line 6 - col. 15, line 8). 
7 



8 Regarding claim 29, Bates et aL discloses: 

9 wherein the data communication is blocked when the target computer content is 
10 time-stamped not before the virus alert time (Bates et al., fig. 3; fig 7). 

11 

12 Regarding claim 30, Bates et al. discloses: 

13 a firewall module monitoring data communications initiated by a target computer 



14 content and sending a request to examine the data communications (Bates et a!., fig. 1 , 

15 elems.20, 30, 50). Bates et al. discloses that the system is useful in a network and it is 

16 capable of filtering trustworthy and untrustworthy computer content - thus, acting as a 

17 firewall module. 

18 an access control console, for generating an access control message specifying 

1 9 an access control rule for blocking data communications of the target computer content 

20 when said content is time-stamped not before a virus alert time, the access control 

2 1 message including a first control parameter enabling the automatic generation of the 

22 virus alert time (Bates et al., fig. 7; fig. 2); 
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1 



and an access control module, coupled to the access control console and the 



2 firewall module, configured to receive the access control message and a request from 

3 the firewall module, and to automatically generate the virus alert time based on the virus 

4 access control time and to determine whether the data communication should be 

5 blocked based on the access control rule (Bates et al., fig. 1 . elem. 44, see rejections of 

6 claims 1 and 2). 
7 

8 Regarding claim 31, it is a program and computer medium claim implementing 

9 the method claim 1, and it is rejected for the same reasons (see also, Bates et al., fig. 
10 1). 

11 

12 Regarding claim 32, Bates et al. discloses: 

1 3 means for entering a computer virus status mode and for automatically 

14 recovering a preselected virus access control time (Bates et al., fig. 7); 

1 5 coupled to the entering and recovering means, means for automatically 

1 6 calculating a virus alert time based on the virus access control time (Bates et al., fig. 1 , 

17 elems. 31.42, 44). 

1 8 and coupled to the calculating virus alert time means, means for comparing a 

1 9 time stamp of a target computer content with the virus alert time prior to execution of the 

20 computer content (Bates et al., fig. 1 , elem. 42). 



21 



22 



Regarding claim 33, Bates et al. discloses: 



Application/Control Number: 10/046.496 Page 14 

Art Unit: 2137 



1 means for storing time-stamped executable computer contents (Bates et al., fig. 

2 1, elem. 46); 

3 a firewall means for monitoring data communications occurring to the executable 

4 computer contents (Bates et a!., fig. 1, elems. 44, 29, 52). 

5 means for entering a computer virus status mode and for automatically 

6 recovering a preselected virus access control time (Bates et al., fig. 7); 

7 coupled to the entering and recovering means, means for automatically 

8 calculating a virus alert time based on the virus access control time (Bates et al., fig, 1, 

9 elems. 31 42, 44). 

1 0 and coupled to the calculating virus alert time means, the storing means, and the 



1 1 firewall means, means for comparing a time stamp of an executable computer content 

12 with the virus alert time to determine whether the data communication occurring to the 

1 3 executable computer content should be blocked (Bates et al., fig. 1 , elem. 44. 42). 
14 

15 
16 



1 7 Claim Rejections - 35 USC § 103 

18 

19 The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

20 obviousness rejections set forth in this Office action: 

21 (a) A patent may not be obtained though the invention is not identically disclosed or described as set 

22 forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 

23 the prior art are such that the subject matter as a whole would have been obvious at the time the 

24 invention was made to a person having ordinary skill in the art to which said subject matter pertains. 

25 Patentability shall not be negatived by the manner in which the invention was made. 
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1 

2 Claim 11 is rejected under 35 U.S.C. 103(a) as being unpatentable over 

3 Bates et al., U.S. Patent 6 J21 J21 B1 In view of Symantec, "Norton Antivirus 

4 Corporate Edition". 

5 

6 Regarding claim 11, Bates et al. discloses that viruses can be found in email 

7 attachments, and that it is well known in the art for antivirus programs to have the 

8 capability for performing antivirus processing on emails and email attachments (Bates et 

9 al., col. 1 , lines 35-63). Bates et al. discloses an antivirus program or module for 

10 performing such antivirus processing (Bates et al., fig. 1, elems. 44, 52). Bates et al., 

1 1 however, does not disclose the details of the antivirus processing for emails and email 

12 attachments. Specifically, Bates et al. does not disclose that the antivirus program or 

13 module removes the computer content from the E-mail body, and denies execution of 

1 4 the computer content. 

15 Symantec discloses an antivirus program and the details of how the program 

16 performs antivirus processing upon an email with an attachment. Symantec discloses 

17 that the antivirus program scans content attached to an email body and removes such 

1 8 content if it is found to contain a virus, thus, denying execution of the content 

19 (Symantec, page 15, par. 2; page 22, "Managing Realtime Protection"). 

20 It would have been obvious for one of ordinary skill in the art to combine the 

21 details disclosed by Symantec for the antivirus processing of emails with the system of 

22 Bates et al. because the system of Bates et al. discloses an antivirus program capable 

23 of performing antivirus processing for processing of emails. 
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1 Response to Arguments 

2 

3 Applicant's arguments filed 8/17/2005 have been fully considered but they are 

4 not persuasive. 
5 

6 Applicants argue primarily that: 

7 

8 (i) Independent claim 1 recites that the first computer virus status mode is 

9 entered "in response to a first computer virus outbreak report, " This implies that there 

1 0 has been an outbreak of a computer virus (as that term is broadly defined). There is no 

1 1 such outbreak of a computer virus in Bates. The passage of Bates cited by the 

12 Examiner on this point (column 1, lines 13-52) is irrelevant, because said passage is a 

1 3 discussion of the prior art. 



14 

15 In response, the examiner reiterates that Bates clearly reports the outbreak of 

16 new and sophisticated viruses. In response to this report, the system of Bates et al. is 

17 used to defend and protect against these outbreaks. The applicant has broadly claimed 

18 a "virus outbreak report", such as is found in Bates et al. The applicant's argument is 

19 unpersuasive. 
20 

21 (ii) Secondly, claim 1 as amended recites that the first computer virus alert time is 
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1 generated "automatically. " This is in sharp contrast to the time entry cited by the 

2 Examiner in Bates (Figure 7, item 214), which is a manual (non-automatic) entry 

3 entered by a human to help categorize whether a certain file should be considered to be 

4 trustworthy or untrustworthy. The passage in Bates (column 7, lines 20-35) cited by the 

5 Examiner is not relevant to this issue. 
6 

7 In response to this argument, as was stated with reference to the amended 

8 claims above, the examiner asserts that the human inputted control parameters are 

9 "automatically" converted or generated into a computer-readable "virus alert time" that is 
10 usable by the system. 

11 

12 (iii) The last two clauses of claim 1 as amended recite that the first computer 

1 3 virus alert time is used in a "real time" determination as to whether the computer 

14 content will be executed. This differs from Bates in the following respects. Looking at 

1 5 the passage of Bates cited by the Examiner (column 12, lines 59-65), it is evident that 

1 6 Bates' timestamp is used only to determine whether the file that is being inspected has 

1 7 been changed. If so, it will be virus-scanned. Time information in Bates is used to create 

1 8 virus status information that is stored on a remote server 30 (not within the confines of 

1 9 the network being protected as in the present invention). This virus status information 

20 is used subsequently (not in real time as recited in Applicants' claim 1) to determine 

21 whether the file is safe to execute or not. 
22 
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1 In response, the applicants allegation "claim 1 as amended recite that tlie first 

2 computer virus alert time is used in a "real time" determination as to whether the 

3 computer content will be executed" is not the limitation of claim. The limitation as 

4 claimed calls for a determination of executability (a determination of a quality), not a 

5 determination of whether the computer content will be executed (a determination of an 

6 action) as erroneously argued by the applicant. Thus, in response to applicant's 

7 argument that the references fail to show certain features of applicant's invention, it is 

8 noted that the features upon which applicant relies (i.e., determination of whether the 

9 computer content will be executed) are not recited in the rejected claim(s). Although the 

10 claims are interpreted in light of the specification, limitations from the specification are 

1 1 not read into the claims. See In re Van Geuns, 988 F.2d 1 181 . 26 USPQ2d 1057 (Fed. 

12 Cir. 1993). 

13 Furthermore, applicant's arguments do not comply with 37 CFR 1 .1 1 1(c) 

14 because they do not clearly point out the patentable novelty which he or she thinks the 

1 5 claims present in view of the state of the art disclosed by the references cited or the 

16 objections made. Further, they do not show how the amendments avoid such 

17 references or objections. Specifically, the applicant alleges, "Time information in Bates 

1 8 is used to create virus status information that is stored on a remote server 30 (not within 

1 9 the confines of the network being protected as in the present invention). The examiner 

20 finds the applicant's argument regarding the location of computer information within a 

21 network irrelevant with respect to the applicant's argument regarding the amended 

22 limitation of "real time". 
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1 Furthermore, the applicant alleges "This virus status information 

2 is used subsequently (not in real time as recited in Applicants' claim 1) to determine 

3 wtiether tlie file is safe to execute or not". In response, the applicant's arguments fail to 

4 comply with 37 CFR 1 .1 1 1(b) because they amount to a general allegation that the 

5 claims define a patentable invention without specifically pointing out how the language 

6 of the claims patentably distinguishes them from the references. Specifically, as shown 

7 above, the applicant does not show any deficiency of the prior art in light of the 

8 amendment to include the limitation of "real time". 
9 

1 0 (iv) A firewall is not suggested in Bates, 

11 

12 In response to this argument, the examiner asserts that the applicant's 

1 3 arguments do not comply with 37 CFR 1 . 1 1 1 (c) because they do not clearly point out 

14 the patentable novelty which he or she thinks the claims present in view of the state of 

15 the art disclosed by the references cited or the objections made. Further, they do not 

16 show how the amendments avoid such references or objections. 



17 The examiner directs the applicant's attention to the reasons of record for the 

18 rejection. 
19 

20 (v) In addition, Applicants' dependent claims contain numerous additional novel 

21 features that are not suggested by the prior art. For example, claim 3 recites that the 

22 first access control time is a relative time stamp. The relative time stamp overcomes the 
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1 problems of time disparity among different computers on the networl<, insuring that all 

2 said computers receive uniform protection. Specification page 4, paragraph 0010. This 

3 relative time stamp is not suggested by the prior art. 
4 

5 In response to applicant's argument that the references fail to show certain 

6 features of applicants invention, it is noted that the features upon which applicant relies 

7 (i.e., a relative time stamp for overcoming problems of time disparity among different 

8 network computers) are not recited in the rejected claim(s). Although the claims are 

9 interpreted in light of the specification, limitations from the specification are not read into 
10 the claims. See In re Van Geuns, 988 F.2d 1 181, 26 USPQ2d 1057 (Fed. Cir. 1993). 
11 

1 2 (vi) Claims 7, 1 7, and 21 recite a hash value used to identify computer content. 

1 3 Safes does not suggest a hash value. His CRC is not a hash value. Column 12, lines 

14 55-58. 
15 

16 In response the examiner directs the applicant's attention to the applicant's own 

17 disclosure, which states: "The hash value ("hash") is a contraction of computer file 

1 8 contents created by applying a hash function" (Spec, page 1 8, lines 3,4). A CRC is a 

19 value representing a small number of bits, created by applying a hash function to a 

20 larger number of bits or a computer file. 
21 
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1 (vii) Claim 24 recites second, third, and fourth control parameters, which enable 

2 a huge degree of granularity in defending an enterprise network against real time 

3 attacks of malicious computer code. These parameters are not suggested by Bates. 
4 

5 Applicant's arguments fail to comply with 37 CFR 1 . 1 1 1 (b) because they amount 

6 to a general allegation that the claims define a patentable invention without specifically 

7 pointing out how the language of the claims patentably distinguishes them from the 

8 references. 
9 

1 0 (viii) The Examiner cites Norton for the recitations of "removing the computer 

1 1 content from the E-mail body" and "denying execution of the computer content. " 

1 2 However, the passages of Norton cited by the Examiner do not support these 

13 recitations. The passage on page 15 of Norton states: "If the file is cleaned, the virus is 

14 successfully and completely removed from the file" i.e., Norton uses the word 

1 5 "removed. " However, Norton says that the virus is removed, not that the computer 

1 6 content is removed as recited in claim 1 1. Similarly, the passage at page 22 of Norton 

1 7 fails to suggest "removing the computer content from the E-mail body. " In fact, the 

1 8 passage at page 22 teaches away from this recitation, because it states: "Norton 

1 9 Antivirus scans only the attachments associated with email. There is no need to scan 

20 the message itself, as mail messages are not subject to computer viruses. " 

21 Similarly, the two passages of Norton cited by the Examiner do not suggest the 

22 recitation of denying execution of the computer content. 
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1 

2 The applicant has alleged that the prior art as combined does not teach the 

3 recitations of "removing the computer content from the E-mail body" and "denying 

4 execution of the computer content." To support such allegations, the applicant states, 

5 Norton says that the virus is removed, not that the computer content is removed as 

6 recited in claim 1 1. The examiner discerns that the applicant is effectively saying that a 

7 computer virus is not computer content. Yet, in contradiction, the applicant previously 

8 states, "As used herein, "computer virus" broadly includes any and all types of malicious 

9 computer code" (Remarks, page 10). The examiner finds the applicant's arguments 

10 unpersuasive. 

1 1 Furthermore, the examiner asserts that the applicant's argument of "teaching 

12 away" is also unpersuasive it is directed towards the scanning of email bodies and not 

13 content attached to email bodies as is claimed. 

14 Furthermore, the examiner asserts that the complete removal of computer 

1 5 content from a computer environment will prevent the removed computer content from 

16 operation within the computer environment that it has been completely removed from. 
17 

18 
19 
20 
21 
22 
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1 Conclusion 

2 

3 The prior art made of record and not relied upon is considered pertinent to 

4 applicant's disclosure: 
5 

6 "Cyclic redundancy check", Wikipedia, 

7 http://en.wikipedia.org/wiki/Cyclic_redundancy_check, accessed 10/31/05. 
8 

9 

10 THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 

1 1 policy as set forth in 37 CFR 1 . 1 36(a). 

12 A shortened statutory period for reply to this final action is set to expire THREE 



13 MONTHS from the mailing date of this action. In the event a first reply is filed within 

14 TWO MONTHS of the mailing date of this final action and the advisory action is not 

15 mailed until after the end of the THREE-MONTH shortened statutory period, then the 

16 shortened statutory period will expire on the date the advisory action is mailed, and any 

17 extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 

18 the advisory action. In no event, however, will the statutory period for reply expire later 

19 than SIX MONTHS from the mailing date of this final action. 
20 
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1 Any inquiry concerning this communication or earlier communications from tfie 

2 examiner should be directed to Jeffery Williams whose telephone number is (571 ) 272- 

3 7965. The examiner can normally be reached on 8:30-5:00. 

4 If attempts to reach the examiner by telephone are unsuccessful, the examiner's 

5 supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone 

6 number for the organization where this application or proceeding is assigned is 571- 

7 273-8300. 

8 Information regarding the status of an application may be obtained from the 

9 Patent Application Information Retrieval (PAIR) system. Status Information for 

10 published applications may be obtained from either Private PAIR or Public PAIR. 

1 1 Status information for unpublished applications is available through Private PAIR only. 

12 For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 

13 you have questions on access to the Private PAIR system, contact the Electronic 

14 Business Center (EBC) at 866-217-9197 (toll-free). 
15 

16 

17 Jeffery Williams 

18 Assistant Examiner 

19 Art Unit: 2137 /V'; 

/<?^ 

EMMANUEL L. MOISE 
SUPERVISORS PATENT EXAMINER 




